EP4698996A1 - Emergency system management mode handler - Google Patents

Abstract

The disclosed technology is directed to a computing device for handling system management interrupt where emergency responses are desired. In some examples, the computing device includes a memory controller and a processor. The memory controller sets a register to a value in response to determining that a memory access matches an attack pattern, and triggers a system management interrupt. Upon detecting the system management interrupt, the processor causes a first thread to enter a system management mode. The first thread then accesses the register. Responsive to determining the register is set to the value, a power reset on the computing device is triggered without waiting for remaining threads to enter the system management mode.

Description

^^^^^^^2 PATENT EMERGENCY SYSTEM MANAGEMENT MODE HANDLER BACKGROUND [0001] In computing systems, different operating modes may be provided to handle corresponding situations. Some computing systems support operating modes that relate to handling processor interrupts. For example, upon detecting a system management interrupt (SMI), a processor can suspend its current execution, enter into a system management mode (SMM), and execute SMI handler code to respond to an event that triggered the SMI. SUMMARY [0002] The systems, methods and devices of this disclosure each have several innovative aspects, no single one of which is solely responsible for all of the desirable attributes disclosed herein. Details of one or more implementations of the subject matter described in this specification are set forth in the accompanying drawings and the description below. [0003] In some embodiments, the techniques described herein relate to a computing device including: a basic input/output system (BIOS) chip to store BIOS code executable by a hardware processor, the BIOS code including an attack pattern; a memory controller to: monitor volatile memory access; determine that the volatile memory access matches the attack pattern; set a first register to a first value in response to determining that the volatile memory access matches the attack pattern; and trigger a system management interrupt; the hardware processor to: detect the system management interrupt; broadcast the system management interrupt to a plurality of threads executed by the hardware processor; cause a first thread of the plurality of threads to enter a system management mode responsive to the system management interrupt; and while a second thread continues to complete an atomic operation: access, using the first thread, the first register without waiting for the second thread to complete the atomic operation; and responsive to determining that the first register is set to the first value, trigger a power reset of the computing device. [0004] In some embodiments, the techniques described herein relate to a computing device, wherein the hardware processor is to access, using the first thread, a set of registers in an access order, and wherein the set of registers includes the first register storing the first value. [0005] In some embodiments, the techniques described herein relate to a computing device, wherein, responsive to determining that the first register is not set to the first value, the first thread accesses a second register of the set of registers. [0006] In some embodiments, the techniques described herein relate to a computing device, wherein, responsive to determining that the first register is set to the first value, the hardware processor triggers the power reset of the computing device without accessing a second register of the set of registers, and wherein the second register is scheduled to be accessed subsequent to accessing the first register. [0007] In some embodiments, the techniques described herein relate to a computing device, wherein the attack pattern corresponds to a direct memory access pattern. [0008] In some embodiments, the techniques described herein relate to a computing device, wherein, responsive to determining that the first register is not set to the first value, the first thread waits for a remaining set of threads to enter the system management mode, and wherein the remaining set of threads includes the second thread. [0009] In some embodiments, the techniques described herein relate to a computing device, wherein the first thread executes a system management interrupt handler code after the remaining set of threads enter the system management mode. [0010] In some embodiments, the techniques described herein relate to a computing device including: a memory controller to set a first register to a first value in response to a determination that volatile memory access matches an attack pattern; and a hardware processor to: detect a system management interrupt; cause a first thread of a plurality of threads to enter a system management mode responsive to the system management interrupt; access, using the first thread, the first register to determine a value stored at the first register; and responsive to determining that the value matches the first value, trigger a power reset of the computing device without waiting for a second thread of the plurality of threads to enter the system management mode. [0011] In some embodiments, the techniques described herein relate to a computing device, further including a basic input/output system (BIOS), wherein the BIOS is to receive firmware code from an external system over a network, and wherein the firmware code may include the attack pattern. In some cases, the firmware code may further include code that configures one or more registers to indicate the presence of a suspected attack (e.g., a pattern of memory access that matches the attack pattern). Further, the firmware code may include code that causes or triggers the power reset of the computing device. [0012] In some embodiments, the techniques described herein relate to a computing device, further including a memory, wherein an address of the first register is specified in a first portion of a system management interrupt handler code stored in the memory, and wherein the hardware processor is to execute, using the first thread, the first portion of the system management interrupt handler code to access the first register. [0013] In some embodiments, the techniques described herein relate to a computing device, wherein the address of the first register is adjustable by an update to the system management interrupt handler code. In some embodiments, the address of the first register may be fixed or at a fixed non-adjustable address. [0014] In some embodiments, the techniques described herein relate to a computing device, wherein responsive to determining that the first register does not match the first value, the first thread waits for the second thread to enter the system management mode and executes a second portion of the system management interrupt handler code after the second thread enter the system management mode. [0015] In some embodiments, the techniques described herein relate to a computing device, wherein the hardware processor is to access, using the first thread, a set of registers in an access order, and wherein the set of registers includes the first register storing the first value. [0016] In some embodiments, the techniques described herein relate to a method of responding to a system management interrupt, the method including: by a hardware processor of a computing system, detecting the system management interrupt; responsive to the system management interrupt, causing a first thread of a plurality of threads to enter a system management mode; accessing, using the first thread, a register of a memory controller to determine a value stored at the register; determining, without waiting for remaining threads of the plurality of threads to enter the system management mode, that the value stored at the register matches an emergency response value; and responsive to determining that the value stored at the register matches the emergency response value, triggering a power reset of the computing system. [0017] In some embodiments, the techniques described herein relate to a method, further including: accessing, using the first thread, a set of registers in an access order, wherein the set of registers includes the register of the memory controller. BRIEF DESCRIPTION OF THE DRAWINGS [0018] Throughout the drawings, reference numbers are re-used to indicate correspondence between referenced elements. The drawings are provided to illustrate examples of the subject matter described herein and not to limit the scope thereof. [0019] Figure 1 illustrates a block diagram of an example computing device in which examples of the present disclosure may be implemented. [0020] Figure 2 illustrates an example block diagram of a processor and storage components utilized to handle system management interrupts generated by the computing device of Figure 1 in accordance with some examples of the present disclosure. [0021] Figures 3A-3B depict illustrative interactions between the processor and storage components of Figure 2 to handle system management interrupts that may trigger an emergency responses in accordance with some examples of the present disclosure. [0022] Figure 4 depicts a flowchart of an example system management mode process in accordance with some examples of the present disclosure. DETAILED DESCRIPTION [0023] Some computing systems enter a system management mode (SMM) upon detection of a system management interrupt (SMI) to execute code or to enable features that are separate from the operating system. In some cases, the SMM may be used to respond to unexpected or undesired events, such as security breaches or hardware failures. In some cases, an SMI may be generated when an unauthorized operation occurs (e.g., an attempt to write to a particular part of memory that is designated as read-only or that is allocated to threads or systems other than the thread or system attempting to write to the particular part of memory). When in SMM, a processor may respond to the SMI by executing handler code that may be stored in inside a system management RAM (SMRAM), a region of memory that may not be accessible unless the processor enters SMM. [0024] A processor may handle the SMI by propagating the SMI to a set of processor threads, which may include some or all of the live threads. The SMI may prompt the processor threads to complete their current instructions and enter SMM. Typically, the thread that enters the SMM first (e.g., the first thread) may acquire a semaphore, a thread lock or the like; wait for the additional or remaining threads to enter SMM to ensure there is no resource conflict between execution of SMI handler code and other program code (e.g., operating system); and execute SMM handler code to identify the cause of the SMI and to respond to the cause of the SMI. When the SMM handler code has finished executing, the first thread may release the semaphore and exit SMM. The additional or remaining threads may wait in SMM until the semaphore is released, and then exit the SMM. A typical SMI response procedure may take milliseconds to tens of milliseconds to complete. [0025] Although seemingly short, there may be situations where the milliseconds of latency incurred in responding to the SMI may be too long. For instance, if the SMI is caused by a malicious directed memory access (DMA) attack it may be desirable to respond immediately to prevent harm from the DMA attack. Waiting for threads to finish their tasks before the threads enter SMM and then respond to the SMI may take too long when responding to the DMA attack. While waiting to process the SMI, the DMA attack or device executing the DMA attack may continue possibly resulting in data loss, data exfiltration, system control loss, or system damage. [0026] As such, it may be desirable to implement an emergency procedure to respond to an SMI triggered by a malicious cause. Embodiments of the present disclosure shorten the latency associated with responding to an SMI triggered by a DMA attack, or other undesirable behavior, by causing at least some executing threads to enter SMM. The first thread that enters SMM may determine the cause of the SMI to respond to the SMI without waiting for the remaining threads to enter the SMM. If the first thread determines the SMI is likely due to a DMA attack or other malicious source, the first thread may trigger an immediate power reset. Advantageously, in certain embodiments, by triggering an immediate power reset, harm from the DMA attack is reduced or eliminated. [0027] In some examples, the disclosed embodiments may be implemented in hardware, firmware, software, or any combination thereof. The disclosed embodiments may be implemented as instructions stored in a transitory or non-transitory computer-readable storage medium, which may be read and executed by a processor core or thread. Further, the instructions may be updated and/or obtained from a remote server via a network connection. Example Computing Device [0028] Figure 1 illustrates a block diagram of an example computing device 100 in which examples of the present disclosure may be implemented. Examples of the computing device 100 may include, but not limited to, laptops, desktops, tablets, wearable computers, smartphones, and personal digital assistants (PDA), hybrid PDA/mobile phone, set-top box, voice command device, and digital media player. In some examples, the computing device 100 includes a processor 110, a memory controller 120, a basic input/output system (BIOS) 130, I/O subsystems 140, a memory 150, and registers 160A. Further, the memory controller 120 may include registers 160B. Registers 160A and 160B can store data that is accessible by different components (e.g., the processor 110 and the memory controller 120) of the computing device 100 for handling the SMI 170, which will be described in greater detail below. Though not illustrated in Figure 1, in some examples, the memory controller 120 can be deployed within the processor 110. For example, the memory controller 120 may be within the uncore of the processor 110. [0029] In some examples, the processor 110 may be embodied as any type of multi- core or multi-thread processor capable of performing functions as described herein. The processor 110 may be embodied as a microprocessor, central processing unit (CPU), digital signal processor, microcontroller, or other processor or processing/controlling circuit. As illustrated in Figure 1, the processor 110 can communicate with the memory controller 120, the BIOS 130, the I/O subsystems 140, and the registers 160A. Further, the processor 110 may directly (not shown in Figure 1) or indirectly (e.g., through the memory controller 120) communicate with the memory 150 to access data and instructions stored in the memory 150 to perform various functions. Additionally, the processor 110 may receive or detect the SMI 170. [0030] In some examples, the I/O subsystems 140 may be embodied as circuitry or components to facilitate input/output operations with the processor 110, the memory 150, and other components of the computing device 100. For example, the I/O subsystems 140 may be embodied as, or otherwise include, platform controller hubs, input/output control hubs, firmware devices, communication links such as bus links and printed circuit board traces, and other components that can facilitate input/output operations associated with components such as the peripherals of the computing device 100. In some examples, the I/O subsystem 104 may be a part of a system-on-a-chip and can be deployed along with the processor 110, the memory 150 and other components of the computing device 100 on a single integrated circuit. [0031] In some examples, the memory 150 may be embodied as any type of volatile or non-volatile memory or data storage, such as dynamic random access memory (DRAM), static random access memory (SRAM), synchronous DRAM (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM). The memory 150 may store various data and program code used during operation of the computing device 100, including operating systems, application programs, libraries, driver, and the like. As mentioned above, the memory 150 may be communicatively coupled to the processor 110 through the memory controller 120, or may be directly coupled to the processor 110. [0032] In some examples, the memory 150 may include system memory 152 that is accessible by the processor 110 after the processor 110 receives or detects the SMI 170. The system memory 152 may be used to store sensitive or secure code (e.g., the handler code 154) not accessible by unless the processor 110 is in the system management mode (SMM), which may be triggered by the SMI 170. In some examples, the system memory 152 may be a system management RAM (SMRAM) and the handler code 154 in the system memory 152 may be set up by the BIOS 130 during bootup process of the computing device 100. The handler code 154 may include information (e.g., data and instructions) that, when executed by the processor 110, allows the processor 110 to handle the SMI 170. [0033] The computing device 100 may further include the registers 160A that can be accessed by the memory controller 120, the processor 110 or the I/O subsystems 140 for handling the SMI 170. The registers 160A may be an addressable storage component that can be set to different logical values at different addressable locations to indicate the occurrence or non-occurrence of certain events. Although illustrated to be external to the processor 110 in Figure 1, the registers 160A can be internal (e.g., fabricated as a part of the circuitry of the processor 110) to the processor 110 in some examples. In other examples, a portion of the registers 160A may be internal to the processor 110 and another portion of the registers 160A may be external to the processor 110. When one of the registers 160A is internal to the processor 110, it may be referred as a processor register. In some examples, one or more of the registers 160A, 160B, or 160C may reside within the memory controller 120. [0034] As used herein, a basic input/output system (BIOS) 130 refers to hardware or hardware and instructions to initialize, control, or operate a computing device prior to execution of an operating system (OS) 156 of the computing device. Instructions included within a BIOS 130 may be software, firmware, microcode, or other programming that defines or controls functionality or operation of a BIOS 130. In one example, a BIOS 130 may be implemented using instructions, such as platform firmware of a computing device, executable by a processor. A BIOS 130 may operate or execute prior to the execution of the OS 156 of a computing device. A BIOS 130 may initialize, control, or operate components such as hardware components of a computing device and may load or boot the OS 156 of a computing device 100. In some examples, a BIOS 130 may provide or establish an interface between hardware devices or platform firmware of the computing device and an OS 156 of the computing device 100, via which the OS 156 of the computing device may control or operate hardware devices or platform firmware of the computing device 100. In some examples, a BIOS 130 may implement the Unified Extensible Firmware Interface (UEFI) specification or another specification or standard for initializing, controlling, or operating a computing device 100. [0035] During operation, one or more of the processor 110, the memory controller 120, and the I/O subsystems 140 may generate the SMI 170 pursuant to various triggering events that may occur. In some examples, the I/O subsystems 140 (e.g., the Platform Controller Hub or PCH) may be responsible for generating the SMI 170 based on one or more inputs received from the processor 110, the memory controller 120, or other components of the computing device 100. Thus, in some cases, other components may indirectly trigger the SMI be communicating with the I/O subsystems 140 or the PCH, which may then generate the SMI. In some examples, when the processor 110 detects receipt of the SMI 170 (e.g., through a hardware pin of the processor 110), the processor 110 enters, or causes a thread to enter, the SMM to execute the handler code 154 to identify the event that triggers the SMI. Depending on the identification results, the processor 110 may further execute the handler code 154 to perform corresponding tasks such as error handling, power management, system management, mitigating malicious attacks, and the like. To identify the event that triggers the SMI, in some examples, the processor 110 may access the registers 160A or 160B (or combinations thereof) to determine the source of the SMI 170. [0036] For instance, when the SMI 170 is generated by a core of the processor 110, the core may set a processor register (e.g., at a particular addressable location of the registers 160A) to a particular value while generating the SMI 170. By accessing the processor register, the processor 110 may read the particular value from the processor register and then determine that the SMI is generated by the core. In other examples, the SMI 170 can be generated by the memory controller 120 when a direct memory access pattern associated with the memory 150 is monitored by the memory controller. In response to monitoring the direct memory access pattern, the memory controller 120 can also set a particular address of the registers 160B to a particular value to allow the processor 110 to identify the SMI-triggering event (e.g., the occurrence of the direct memory access pattern) by accessing the register at that particular address. In some examples, multiple registers in registers 160A or 160B can be set by different components of the computing device 100 such as the processor 110, the memory controller 120 or the I/O subsystems 140. By tracing the registers that are set (e.g., in a manner like tracing from a leaf to a root of a tree-like data structure), the processor 110 may eventually identify the cause of the SMI 170 and respond to the situation accordingly. Example SMI Handling Blocks [0037] Figure 2 illustrates an example block diagram of a processor 110 and storage components (e.g., the memory 150, the power control register 218, the registers 160A, and registers 160B) that can be utilized to handle a system management interrupt (SMI) 170 with which emergency responses are desired in accordance with some examples of the present disclosure. [0038] As illustrated in Figure 2, the processor 110 includes cores 212A through 212N and processor uncore 220 that includes registers 160C and cache 216. Each of the cores 212A through 212N may be an independent processing unit that is capable of executing the same or different instructions. N may be any positive integer such that any number of cores in the processor 110 can be accommodated. [0039] As shown in Figure 2, each of the cores 212A through 212N can correspond to one of the threads 222A through 222N that can be utilized by the processor 110 to execute programmed code simultaneously. Specifically, the core 212A can correspond to the thread 222A, the core 212B can correspond to the thread 222B, and the core 212N can correspond to the thread 222N. Each of the threads 222A through 222N may execute a stream of instructions to perform tasks such as accessing registers 160A, 160B and 160C or execute the handler code 154. The threads 222A-222N may each be processor threads. Further, in some cases, at least one of the cores 212A-212N may be capable of implementing one or a plurality of processor threads. [0040] Though Figure 2 illustrates a one-to-one relationship between cores and threads, the threads to cores correspondence does not have to be a one-to-one relationship. In some examples, different relationship between the threads and cores can exist. For instance, each of the cores 212A through 212N may correspond to two threads, four threads or other number of threads concurrently. [0041] In some examples, the processor uncore 220 may include any part of the processor 110 not included in the cores 212A through 212N, such as the registers 160C and cache 216. The registers 160C may store different logical values at one or more addressable locations to assist the processor 110 to handle the SMI 170. For instance, when the SMI 170 is generated by the core 212B, the core 212B may set a value at a register 160C assigned to or associated with the core 212B to a particular logical value. By accessing the register 160C assigned to the core 212B, the processor 110 can determine that the SMI 170 is generated by the core 212B and interrogate the core 212B for further information to handle the SMI 170. In some examples, the processor uncore 220 may include the memory controller 120. [0042] In some examples, the SMI 170 may be generated or triggered by other components, such as the memory controller 120 illustrated in Figure 1. Specifically, the memory controller 120 may monitor access of the memory 150 and determine that the access of the memory 150 matches an attack pattern or an attack signature. The attack pattern may be included or defined in code stored in the BIOS 130 or elsewhere that is accessible by the memory controller 120, and may correspond to a particular SMI-triggering situation where an emergency response is desired. In contrast to a non-emergency SMI response where a processor may wait for all live threads to enter SMM before executing SMI handler code to respond to the cause of the SMI, during an emergency SMI response (or emergency response) the processor may execute SMI handler code to respond to the SMI without waiting for all live threads to enter SMM. As such, an emergency response may shorten the latency in responding to the SMI by milliseconds or tens of milliseconds. Though seemingly short, such latency reduction can reduce the chance of permanent damage, mitigate data corruption, or prevent successful malicious access of system resources or data under some situations. [0043] In certain embodiments, malicious access to the computing device 100 may be detected using signature analysis. For example, malicious memory access, such as a DMA attack, may be detected by comparing a memory access pattern to an attack pattern that corresponds to one or more known malicious memory access patterns. When a malicious device accesses the system memory 152, the pattern of memory access may match an attack pattern. This attack pattern may be provided to or stored in in the BIOS 130. The memory controller 120 may access the attack pattern from the BIOS 130 and can compare the attack pattern to one or more memory access patterns. The attack pattern may be or may correspond to particular memory accesses, particular memory locations, and/or memory accesses over a particular time period or under a particular condition of the computing device 100. For example, the attack pattern may correspond to a particular memory access pattern. In other examples, the attack pattern may correspond to a series of memory accesses over a particular time period. In yet other examples, the attack pattern may be a particular memory access in a particular memory space by a particular core of the processor 110. In some cases, the attack pattern may correspond to memory access by a particular core of the processor 110 that is not authorized to access that particular memory space. [0044] Upon determining that the data access pattern matches the attack pattern, the memory controller 120 can write a value to a register 160B and trigger the SMI 170. For example, the memory controller 120 may set a particular register 160B to a first value to indicate the occurrence of a memory access that matches the attack pattern. [0045] Upon detecting the SMI 170, the processor 110 may broadcast to the threads 222A through 222N that the SMI 170 is detected to cause the threads 222A through 222N to enter the system management mode (SMM). Assuming the threads 222A enters the SMM earlier than the remaining threads 222B through 222N, the thread 222A may start identifying the cause that triggers the SMI 170 without waiting for the remaining threads 222B through 222N to enter the SMM. In some examples, the thread 222A may identify the cause that triggers the SMI by accessing the registers 160A, registers 160B, or registers 160C. [0046] For example, the thread 222A may access the particular register 160B to determine that the particular register 160B is set to the first value, which indicates the occurrence of the memory access that matches the attack pattern. In response to determining that the particular register 160B is set to the first value, the thread 222A may trigger a power reset of the computing device 100 regardless of whether the remaining threads 222B through 222N have entered the SMM. As such, the computing device 100 may then be shut down timely to prevent uncorrectable data corruption that otherwise would result from the continuance of the malicious direct memory access. Example Emergency Reponses in SMM [0047] With reference to Figures 3A and 3B, illustrative interactions will be described depicting how elements such as the processor 110, the memory controller 120 and memory 150 of Figure 2 can coordinate to handle an event where an emergency response may be desired. The interactions of Figure 3A begin at (1), where the memory controller 120 monitors an access of the memory 150. In some examples, the memory controller 120 may monitor a particular access pattern of the memory 150. [0048] At (2), the memory controller 120 may determine that the access of the memory 150 matches an attack pattern. In some examples, the attack pattern may be included or defined in code stored in the BIOS 130, and may be referenced by the memory controller 120 to determine whether the access of the memory 150, or a pattern of memory access, matches the attack pattern. [0049] In response to determining that the memory access of the memory 150 matches the attack pattern, at (3), the memory controller 120 may trigger a system management interrupt (SMI). Further, the memory controller 120 may set a first register to a first value to indicate the occurrence of the memory access that matches the attack pattern. In some examples, the memory controller sets an addressable location of the registers 160B to a particular value to indicate that the memory access matches the attack pattern. [0050] At (4), the processor 110 detects the SMI triggered by the memory controller 120. In some examples, the detection is performed by the processor uncore 220 of the processor 110. In some examples, the SMI may be generated by the memory controller 120 of the computing device 100 when the memory controller 120 determines that an access of the memory 150 matches an attack pattern corresponding to a malicious direct memory access (DMA) where emergency responses are desired. Under this example, the memory controller 120 may also set a particular register (e.g., a particular addressable location of the registers 160B that can be physically inside the memory controller 120) to a particular value to indicate the occurrence of the malicious direct memory access that matches the attack pattern. As will be discussed below, the particular register can be accessed by the processor 110 to determine the occurrence of the malicious direct memory access so as to initiate emergency responses. [0051] At (5), the processor uncore 220 may broadcast the SMI to the threads 222A-222N executed by the processor 110 to cause the threads 222A-222N to enter the system management mode (SMM). As mentioned above, in some examples, each of the threads 222A- 222N may correspond to each core 212A-212N. Alternatively, a core may execute one or a plurality of threads. [0052] Accordingly, at (6), the threads 222A-222N may attempt to enter the SMM in response to receiving the broadcast of the SMI detected by the processor 110. In some examples, threads 222A-222N may enter the SMM at different time instants dependent upon the instruction each thread is executing when the processor uncore 220 broadcasts the SMI to each thread. In some examples, the thread that enters the SMM first may acquire a semaphore to indicate that it has entered the SMM earlier than any other threads. [0053] Assuming for illustrative purposes that thread 222A enters the SMM earlier than threads 222B-222N, then at (7), the thread 222A may load and execute the handler code 154 from the system memory 152 for handling the SMI. As mentioned above, the system memory 152 may be the system management RAM (SMRAM) and the handler code 154 may be set up by the BIOS 130 during bootup of the computing device 100. In other examples, the handler code 154 may be updated as a part of a firmware update to the computing device 100. [0054] With reference now to Figure 3B, at (8), the thread 222A may access a set of registers in an access order to determine if a source of the SMI is associated with an emergency event. In some examples, the thread 222A may utilize information included in the handler code 154 to access the set of registers for responding to the SMI. In one example, the handler code 154 may specify an address of the particular register that is set by the memory controller 120 at (3). In this example, the handler code 154 may further specify that a particular value set to the particular register indicates an occurrence of the malicious direct memory access where emergency responses are desired. [0055] In some examples, the thread 222A may access a set of registers (e.g., one or more of the registers 160C, registers 160A and registers 160B) in a particular order. The order may be determined in advance or based on metadata associated with the SMI. In some examples, the thread 222A may access each register of the set of registers. Further, in some examples, the thread 222A may access registers within the set of registers until a particular register set by the memory controller 120 is accessed that indicates an occurrence of an event that triggered the SMI. [0056] At (9), based on the access of the registers 160B, the thread 222A may determine that a first register (e.g., a particular register 160B) associated with the memory controller 120 is set to a first value that indicates an occurrence of an emergency event, such as malicious direct memory access that matches an attack pattern. As such, the thread 222A may determine to execute an emergency response based on the determination of occurrence of the DMA attack, other high-priority or an emergency event. [0057] In other examples, based on a determination that the DMA attack, other high-priority event, or an emergency event does not occur, the thread 222A may not execute the emergency response. For example, when the thread 222A determines that the first register associated with the memory controller 120 is not set to the first value, the thread 222A may determine a DMA attack does not occur and determine not to execute the emergency response. [0058] At (10), the thread 222A may power reset the computing device 100 in response to determining that the first register associated with the memory controller 120 is set to the first value. In some examples, the thread 222A may trigger the power reset by writing a value to an address of the power control register 218. The address of the power control register 218 may be monitored by a component (e.g., a power management integrated circuit) of the computing device 100. Upon monitoring that the address of the power control register is set to the value, the component may power reset the computing device 100 to reduce or eliminate the harm incurred from the memory access monitored by the memory controller 120 at (1). Example SMM Handling Flowchart [0059] With reference to Figure 4, an illustrative process 400 for handling a system management interrupt generated on a computing device will be described. The process 400 may be implemented, for example, by the processor 110. [0060] The process begins at block 402, where the processor 110 of the computing device 100 detects occurrence of a system management interrupt. As discussed above, the system management interrupt may be generated by the processor 110, the memory controller 120 or the I/O subsystems 140 of the computing device 100. In some examples, the SMI 170 may or may not indicate an occurrence of an emergency event. In cases where the SMI corresponds to an emergency event, the processor 110 may execute an emergency handling process using the SMM. In some examples, the SMI 170 may be input into a pin of the processor 110 and provided to the processor uncore 220 of the processor 110. In some examples, the processor 110 may execute a plurality of threads (e.g., threads 222A-222N) when the processor 110 detects the system management interrupt. In some examples, instead of receiving the SMI 170 from a physical pin, virtual wires may be utilized. For example, a message may be sent from a SMI source (e.g., the I/O subsystems 140) through a virtual wire on a direct media interface (DMI) bus to the processor 110 to indicate occurrence of system management interrupt. [0061] At block 404, the processor 110 of the computing device 100 may cause a first thread to enter the SMM. For example, the first thread may be one of the threads 222A- 222N that enters the SMM earlier than the remaining threads. [0062] In some examples, the remaining threads may attempt to enter the SMM after the first thread has entered the SMM and upon completion of any atomic operations being performed by the threads. However, the first thread may continue to process handler code 154 without waiting for the remaining threads to enter the SMM. In some examples, the first thread entering the SMM may issue a system-wide SMI to cause the remaining threads to enter SMM. [0063] At block 408, the processor 110 may access a set of registers to determine a source associated with the detected system management interrupt without waiting for the remaining threads to complete any atomic operations. More specifically, the processor 110 may access the set of registers using the first thread (e.g., thread 222A). The set of registers may include portions of the registers 160A, the registers 160B and the registers 160C. In some examples, some of the set of registers (e.g., the registers 160B) may be within the memory controller 120. The processor 110 may access the set of registers in a particular order. The order of access of the registers may be defined by SMM handler code, the BIOS 130, or any other system control process. The order of access of the registers may be referred to as a register access tree, register access list, or register access queue. Further, the processor 110 may continue to access the set of registers in the particular defined order up to and/or until a particular register is determined to be associated with a value that indicates the source or cause of the SMI. For example, if the first accessed register indicates that the system (e.g., a fan controller) associated with the register is the source of the SMI, the processor 110 may cease accessing the set of registers. If it is determined that the first accessed register does not store a value indicating the source or cause of the SMI, the processor 110 may access another register (e.g., the next register in the register access tree) to determine whether an associated system within the computing device 100 is the source or cause of the SMI. [0064] At block 410, the processor 110 may determine if the source of the system management interrupt is associated with an emergency event with which emergency responses in SMM are desired. Specifically, the processor 110 may use the first thread (e.g., thread 222A) to determine if the source of the system management interrupt indicates the occurrence of the emergency event (e.g., a direct memory access pattern that matches an attack pattern). In some examples, the first thread may determine that the source of the system management interrupt indicates occurrence of an emergency event based on a value of an accessed register. [0065] If it is determined at the decision block 410 that the source of the SMI is associated with an emergency event, the process 400 proceeds to block 412, where the processor 110 triggers a power reset of the computing device. By triggering the power reset, the processor 110 is able to reduce or prevent harm from the emergency event, such as data corruption, loss of computing resource access, physical damage to the computing device 100 that otherwise would result from the continuance of the emergency event that triggers the system management interrupt of block 402. [0066] If it is determined at the decision block 410 that the source of the SMI is not associated with an emergency event, the process 400 proceeds to block 414. At block 414, the processor 110 may permit the remaining threads (e.g., threads 222B-222N) to enter the system management mode. In some embodiments, the block 414 may include acquiring a semaphore using the first thread and waiting for the remaining threads to enter SMM before taking further action. Further, in some embodiments, the block 414 may include causing each thread to complete processing instructions being executed prior to occurrence of the SMI. Additionally, the block 414 may include the threads flushing an associated cache. [0067] At block 416, the processor 110 may execute system management interrupt handler code to respond to the system management interrupt after the remaining threads enter the system management mode. [0068] As will be appreciated by one of skill in the art in light of the present disclosure, certain embodiments disclosed herein improve the ability of computing devices, such as hardware processors for handling SMIs, to mitigate damage caused by unauthorized operations. Specifically, the presently disclosed embodiments address technical problems inherent within computing systems: the undesirable latency incurred when handling some SMI triggering events with which emergency responses are desired. These technical problems are addressed by the various technical solutions described herein, including the use of a first thread entering SMM to determine a cause of detected SMI and trigger a power reset of a computing device based on the determination without waiting for remaining threads entering SMM. Thus, the present disclosure represents an improvement in computing systems. [0069] It should be noted that the description and the figures above merely illustrate the principles of the present subject matter along with examples described herein and should not be construed as a limitation to the present subject matter. It is thus understood that various arrangements may be devised that although not explicitly described or shown herein, embody the principles of the present subject matter. Moreover, all statements herein reciting principles, aspects, and implementations of the present subject matter, as well as specific examples thereof, are intended to encompass equivalents thereof. Terminology [0070] It is to be understood that not necessarily all objects or advantages may be achieved in accordance with any particular example described herein. Thus, for example, those skilled in the art will recognize that some examples may be operated in a manner that achieves or optimizes one advantage or group of advantages as taught herein without necessarily achieving other objects or advantages as may be taught or suggested herein. [0071] All of the processes described herein may be embodied in, and fully automated via, software code modules executed by a computing system that includes computers or processors. The code modules may be stored in any type of non-transitory computer-readable medium or other computer storage device. Some or all the methods may be embodied in specialized computer hardware. [0072] Many other variations than those described herein will be apparent from this disclosure. For example, depending on the example, some acts, events, or functions of any of the algorithms described herein can be performed in a different sequence, can be added, merged, or left out altogether (for example, not all described acts or events are necessary for the practice of the algorithms). Moreover, in some examples, acts or events can be performed concurrently, for example, through multi-threaded processing, interrupt processing, or multiple processors or processor cores, or on other parallel architectures, rather than sequentially. In addition, different tasks or processes can be performed by different machines and/or computing systems that can function together. [0073] The various illustrative logical blocks and modules described in connection with the examples disclosed herein can be implemented or performed by a machine, such as a processing unit or processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic, discrete hardware components, or any combination thereof designed to perform the functions described herein. A processor can be a microprocessor, but in the alternative, the processor can be a controller, microcontroller, or state machine, combination of the same, or the like. A processor can include electrical circuitry to process computer-executable instructions. In some examples, a processor includes an FPGA or other programmable device that performs logic operations without processing computer-executable instructions. A processor can also be implemented as a combination of computing devices, for example, a combination of a DSP and a microprocessor, a plurality of microprocessors, microprocessors in conjunction with a DSP core, or any other such configuration. Although described herein primarily with respect to digital technology, a processor may also include primarily analog components. A computing environment can include any type of computer system, including, but not limited to, a computer system based on a microprocessor, a mainframe computer, a digital signal processor, a portable computing device, a device controller, or a computational engine within an appliance, to name a few. [0074] The elements of a method, process, routine, or algorithm described in connection with the embodiments disclosed herein can be embodied directly in hardware, in a software module executed by a processor device, or in a combination of the two. A software module can reside in RAM memory, flash memory, ROM memory, EPROM memory, EEPROM memory, registers, hard disk, a removable disk, a CD-ROM, or any other form of a non-transitory computer-readable storage medium. An exemplary storage medium can be coupled to the processor device such that the processor device can read information from, and write information to, the storage medium. In the alternative, the storage medium can be integral to the processor device. The processor device and the storage medium can reside in an ASIC. The ASIC can reside in a user terminal. In the alternative, the processor device and the storage medium can reside as discrete components in a user terminal. [0075] The processes described herein or illustrated in the figures of the present disclosure may begin in response to an event, such as on a predetermined or dynamically determined schedule, on demand when initiated by a user or system administrator, or in response to some other event. When such processes are initiated, a set of executable program instructions stored on one or more non-transitory computer-readable media (e.g., hard drive, flash memory, removable media, etc.) may be loaded into memory (e.g., RAM) of a server or other computing device. The executable instructions may then be executed by a hardware-based computer processor of the computing device. In some embodiments, such processes or portions thereof may be implemented on multiple computing devices and/or multiple processors, serially or in parallel. [0076] Conditional language such as, among others, “can,” “could,” “might” or “may,” unless specifically stated otherwise, are otherwise understood within the context as used in general to convey that some examples include, while other examples do not include, some features, elements and/or steps. Thus, such conditional language is not generally intended to imply that features, elements and/or steps are in any way for examples or that examples necessarily include logic for deciding, with or without user input or prompting, whether these features, elements and/or steps are included or are to be performed in any particular example. [0077] Disjunctive language such as the phrase “at least one of X, Y, or Z,” unless specifically stated otherwise, is otherwise understood with the context as used in general to present that an item, term, etc., may be either X, Y, or Z, or any combination thereof (for example, X, Y, and/or Z). Thus, such disjunctive language is not generally intended to, and should not, imply that some examples require at least one of X, at least one of Y, or at least one of Z to each be present. [0078] Any process descriptions, elements or blocks in the flow diagrams described herein and/or depicted in the attached figures should be understood as potentially representing modules, segments, or portions of code which include executable instructions for implementing specific logical functions or elements in the process. Alternate examples are included within the scope of the examples described herein in which elements or functions may be deleted, executed out of order from that shown, or discussed, including substantially concurrently or in reverse order, depending on the functionality involved as would be understood by those skilled in the art. [0079] It should be emphasized that many variations and modifications may be made to the above-described examples, the elements of which are to be understood as being among other acceptable examples. All such modifications and variations are intended to be included herein within the scope of this disclosure. [0080] Any process descriptions, elements or blocks in the flow diagrams described herein and/or depicted in the attached figures should be understood as potentially representing modules, segments, or portions of code which include executable instructions for implementing specific logical functions or elements in the process. Alternate implementations are included within the scope of the examples described herein in which elements or functions may be deleted, executed out of order from that shown, or discussed, including substantially concurrently or in reverse order, depending on the functionality involved as would be understood by those skilled in the art. [0081] Unless otherwise explicitly stated, articles such as “a” or “an” should generally be interpreted to include one or more described items. Accordingly, phrases such as “a device configured to” are intended to include one or more recited devices. Such one or more recited devices can also be collectively configured to carry out the stated recitations. For example, “a processor configured to carry out recitations A, B, and C” can include a first processor configured to carry out recitation A working in conjunction with a second processor configured to carry out recitations B and C.

Claims

WHAT IS CLAIMED IS: 1. A computing device comprising: a basic input/output system (BIOS) chip to store BIOS code executable by a hardware processor, the BIOS code including an attack pattern; a memory controller to: monitor volatile memory access; determine that the volatile memory access matches the attack pattern; set a first register to a first value in response to determining that the volatile memory access matches the attack pattern; and trigger a system management interrupt; the hardware processor to: detect the system management interrupt; broadcast the system management interrupt to a plurality of threads executed by the hardware processor; cause a first thread of the plurality of threads to enter a system management mode responsive to the system management interrupt; and while a second thread continues to complete an atomic operation, access, using the first thread, the first register without waiting for the second thread to complete the atomic operation; and responsive to determining that the first register is set to the first value, trigger a power reset of the computing device.

2. The computing device of claim 1, wherein the hardware processor is to access, using the first thread, a set of registers in an access order, and wherein the set of registers includes the first register storing the first value.

3. The computing device of claim 2, wherein, responsive to determining that the first register is not set to the first value, the first thread accesses a second register of the set of registers.

4. The computing device of claim 2, wherein, responsive to determining that the first register is set to the first value, the hardware processor triggers the power reset of the computing device without accessing a second register of the set of registers, and wherein the second register is scheduled to be accessed subsequent to accessing the first register.

5. The computing device of claim 1, wherein the attack pattern corresponds to a direct memory access pattern.

6. The computing device of claim 1, wherein, responsive to determining that the first register is not set to the first value, the first thread waits for a remaining set of threads to enter the system management mode, and wherein the remaining set of threads includes the second thread.

7. The computing device of claim 6, wherein the first thread executes a system management interrupt handler code after the remaining set of threads enter the system management mode.

8. A computing device comprising: a memory controller to set a first register to a first value in response to a determination that volatile memory access matches an attack pattern; and a hardware processor to: detect a system management interrupt; cause a first thread of a plurality of threads to enter a system management mode responsive to the system management interrupt; access, using the first thread, the first register to determine a value stored at the first register; and responsive to determining that the value matches the first value, trigger a power reset of the computing device without waiting for a second thread of the plurality of threads to enter the system management mode.

9. The computing device of claim 8, further comprising a basic input/output system (BIOS), wherein the BIOS is to receive firmware code from an external system over a network, and wherein the firmware code includes the attack pattern.

10. The computing device of claim 8, further comprising a memory, wherein an address of the first register is specified in a first portion of a system management interrupt handler code stored in the memory, and wherein the hardware processor is to execute, using the first thread, the first portion of the system management interrupt handler code to access the first register.

11. The computing device of claim 10, wherein the address of the first register is adjustable by an update to the system management interrupt handler code.

12. The computing device of claim 10, wherein responsive to determining that the first register does not match the first value, the first thread waits for the second thread to enter the system management mode and executes a second portion of the system management interrupt handler code after the second thread enter the system management mode.

13. The computing device of claim 8, wherein the hardware processor is to access, using the first thread, a set of registers in an access order, and wherein the set of registers includes the first register storing the first value.

14. A method of responding to a system management interrupt, the method comprising: by a hardware processor of a computing system, detecting the system management interrupt; responsive to the system management interrupt, causing a first thread of a plurality of threads to enter a system management mode; accessing, using the first thread, a register of a memory controller to determine a value stored at the register; determining, without waiting for remaining threads of the plurality of threads to enter the system management mode, that the value stored at the register matches an emergency response value; and responsive to determining that the value stored at the register matches the emergency response value, triggering a power reset of the computing system.

15. The method of claim 14, further comprising: accessing, using the first thread, a set of registers in an access order, wherein the set of registers includes the register of the memory controller.